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Response to Amendment 

This office action is responsive to Applicant's amendment received on 3/6/2006. 
Claims 1, 3, 14, and 18-31 are amended. Claims 1-31 are pending. 

Response to Arguments 

Applicant's arguments, see Remarks, filed 3/6/2006, with respect to the 
rejection(s) of claim(s) 1-31 under 35 U.S.C. 102(e) and 35 U.S.C. 103(a) have been 
fully considered and are persuasive in terms of the limitation dealing with "administrative 
application". Therefore, the rejection has been withdrawn. However, upon further 
consideration, a new ground(s) of rejection is made in view of a newly found prior art 
reference. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1-8, 10-24, and 26-31 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Gupta et al., (U.S. Patent No. 6,226,752 and Gupta hereinafter), in 
view of Barry et al., (U.S. Publication No. 2005/0216421 and Barry hereinafter). 
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Regarding claims 1, 3, and 14, Gupta discloses a generic token-based system 
for integrating a target application on a first server to an authentication system for 
authenticating users of the target application, the generic system comprising a second 
server coupled to a database of configuration information about a login process for the 
target application, the second server being programmed to access the database of 
configuration information to conduct the login process with a user of the target 
application and to use the authentication system to authenticate the user and to issue at 
least one token to enable the user to access the target application once the 
authentication system authenticates the user (col. 11, lines 10-67 and col. 12-12, lines 
1-67), wherein the second server is programmed to receive a Uniform Resource Locator 
including an identification of the target application, and the second server is further 
programmed to use the identification of the target application for looking up the 
configuration information for the login process from the database (Col. 3, lines 22-67 
and Col. 4, lines 1-50). 

Gupta does not disclose an administrative application program to present a 
graphical user interface to a system administrator for creating and editing the 
configuration information. 

However, Barry discloses an administrative application program to present a 
graphical user interface to a system administrator for creating and editing the 
configuration information (par. 0234-0245). 
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Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time of applicant's invention to modify teachings of Gupta with teachings of Barry 
because it would allow to include an administrative application program to present a 
graphical user interface to a system administrator for creating and editing the 
configuration information as disclosed by Barry. This modification would have been 
obvious because one of ordinary skill in the art would have been motivated by the 
suggestion of Barry to provides a common GUI for the customer (i.e., administrator) 
enabling both report requesting, customizing, scheduling and viewing of various types 
of data from different back-end telecommunications service and applications at a single 
point of customer contact (Barry, par. 0020). 

Regarding claims 18, 27, and 31, Gupta discloses a method of using an 
authentication system for authenticating users of a target application on a first server, 
the method comprising maintaining a database of configuration information about a 
login process for the target application (col. 13, lines 7-40), and using a second server 
to access the database of configuration information to conduct the login process with a 
user of the target application and to use the authentication system to authenticate the 
user and to issue at least one token to enable the user to access the target application 
once the authentication system has authenticated the user, wherein a data network 
couples the first server to the second server, and the second server receives a Uniform 
Resource Locator including an identification of the target application and uses the 
identification of the target integrated with the authentication system, and pages for 
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creating and editing a selected one of the target applications (Col. 11, lines 25-67, 
Col.12, lines 1-67 and Col. 13, lines 1-19). 

Gupta does not expressly disclose using a graphical user interface of an 
administrative application to generate the configuration information to define the login 
process (par. 0234-0245). 

However, Barry discloses using a graphical user interface of an administrative 
application to generate the configuration information to define the login process. 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time of applicant's invention to modify teachings of Gupta with teachings of Barry 
because it would allow to include using a graphical user interface of an administrative 
application to generate the configuration information to define the login process as 
disclosed by Barry. This modification would have been obvious because one of ordinary 
skill in the art would have been motivated by the suggestion of Barry to provides a 
common GUI for the customer (i.e., administrator) enabling both report requesting, 
customizing, scheduling and viewing of various types of data from different back-end 
telecommunications service and applications at a single point of customer contact 
(Barry, par. 0020). 

Regarding claims 2 and 19, Gupta discloses wherein the authentication system is 
a centralized authentication system of a business organization, and the target 
application is in a third-party web server (i.e., application server) coupled by a network 
to the centralized authentication system (col. 11, lines 25-67, col.12, lines 1-7), and the 
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login process includes redirection of a user login request from the third-party web server 
to a server (i.e., login server) accessing the database and the centralized authentication 
system (col. 12, lines 7-67 and Col. 13, lines 1-19). 

Regarding claims 4 and 20, Gupta discloses wherein the configuration database 
includes configuration information for configuring a plurality of applications to the 
authentication system, the target application transmits a Uniform Resource Locator 
including an identification of the target application, and the method includes obtaining 
the identification of the target application from the Uniform Resource Locator, and using 
the identification of the target application for looking up the configuration information for 
the target application from the database (col. 5, lines 43-67 and col. 6, lines 1-20 and 
col. 13, lines 7-40). 

Regarding claims 5, 15, 21, and 28, Gupta discloses wherein the server is 
programmed to obtain from the database configuration information defining an inbound 
parameter, and the server is programmed to receive the inbound parameter from the 
target application (i.e., the redirected request sent by the user's browser for a specific 
URL)(col. 11, lines 39-67, col. 12, lines 1-67). 

Regarding claims 6, 16, 22, and 29, Gupta discloses wherein the server is 
programmed to obtain from the database configuration information defining a natural 
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language, and the server is programmed to use the natural language for communication 
with the user during the login process (Col. 2, lines 15-67 and Col. 3, lines 1-14). 

Regarding claims 7, 17, 23, and 30, Gupta discloses wherein the server is 
programmed to obtain from the database configuration information defining an outbound 
parameter, and the server is programmed to send the outbound parameter (i.e., 
information about the authenticated user) to the target application once the 
authentication system has authenticated the user (col. 11, lines 39-67, col. 12, lines 1- 
67). 

Regarding claims 10 and 26, Gupta does not expressly disclose wherein the 
graphical user interface includes at least one page for exporting and importing 
authentication integration projects. 

However, Barry discloses wherein the graphical user interface includes at least 
one page for exporting and importing authentication integration projects (par. 0234- 
0245). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time of applicant's invention to modify teachings of Gupta with teachings of Barry 
because it would allow to include wherein the graphical user interface includes at least 
one page for exporting and importing authentication integration projects as disclosed 
by Barry. This modification would have been obvious because one of ordinary skill in 
the art would have been motivated by the suggestion of Barry to provides a common 
GUI for the customer (i.e., administrator) enabling both report requesting, customizing, 
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scheduling and viewing of various types of data from different back-end 
telecommunications service and applications at a single point of customer contact 
(Barry, par. 0020). 

Regarding claim 12, Gupta discloses wherein the server includes a data cache 
coupled to the database (Col. 1 3, lines 20-29). 

Regarding claim 13, Gupta discloses wherein the server is programmed with a 
plurality of authentication modules for integrating respective target applications to the 
authentication system, and the server is programmed with an authentication module 
controller (i.e., login service) for directing user login requests to the respective 
authentication modules (i.e., authentication service)(Col. 11, lines 10-67, Col. 12, lines 1- 
41). 

Regarding claims 8 and 24, Gupta does not expressly disclose creating and 
editing the configuration information and the graphical user interface including pages for 
listing active and inactive target applications integrated with the authentication system. 

However, Barry discloses wherein the administrative application is programmed 
to present a graphical user interface to the system administrator for creating and editing 
the configuration information, and the graphical user interface includes pages for listing 
active and inactive target applications integrated with the authentication system, and 
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pages for creating and editing a selected one of the target applications (par. 0205- 
0207). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time of applicant's invention to modify teachings of Gupta with teachings of Barry 
because it would allow to include the graphical user interface including listing active 
and inactive target applications integrated with the authentication system (i.e., 
controlling customer access to product and services), and pages for creating and 
editing a selected one of the target applications as disclosed by Barry. This 
modification would have been obvious because one of ordinary skill in the art would 
have been motivated by the suggestion of Barry to provides a common GUI for the 
customer (i.e., administrator) enabling both report requesting, customizing, scheduling 
and viewing of various types of data from different back-end telecommunications 
service and applications at a single point of customer contact (Barry, par. 0020). 

Regarding claim 11, Gupta does not expressly disclose creating and editing the 
configuration information, the administrative application includes a series of action 
modules for presenting respective pages of the graphical user interface to the system 
administrator. 

However, Barry discloses wherein the administrative application is programmed 
to present a graphical user interface to the system administrator for creating and editing 
the configuration information, the administrative application includes a series of action 
modules for presenting respective pages of the graphical user interface to the system 
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administrator, and the action modules are programmed for invoking business logic (par. 
0234-0245). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time of applicant's invention to modify teachings of Gupta with teachings of Barry 
because it would allow to include wherein the administrative application is programmed 
to present a graphical user interface to the system administrator for creating and 
editing the configuration information, the administrative application includes a series of 
action modules for presenting respective pages of the graphical user interface to the 
system administrator, and the action modules are programmed for invoking business 
logic as disclosed by Barry. This modification would have been obvious because one of 
ordinary skill in the art would have been motivated by the suggestion of Barry to 
provides a common GUI for the customer (i.e., administrator) enabling both report 
requesting, customizing, scheduling and viewing of various types of data from different 
back-end telecommunications service and applications at a single point of customer 
contact (Barry, par. 0020). 

Claims 9 and 25 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Gupta et al., (U.S. Patent No. 6,226,752 and Gupta hereinafter), in view of Barry et al., 
(U.S. Publication No. 2005/0216421 and Barry hereinafter), in further view of Khidekel 
et al., (U.S. Publication No. 2001/0027527 and Khidekel hereinafter). 
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Teachings of Gupta and Barry with regard to limitations of claims 1 and 18 have 
been discussed previously. 

Regarding claims 9 and 25, Barry discloses wherein the administrative 
application is programmed to present a graphical user interface to the system 
administrator for creating and editing the configuration information, and the graphical 
user interface includes pages for selecting a natural language for conducting the login 
process, for specifying inbound parameters to be received from the target application 
and outbound parameters to be sent to the target application, for configuring at least 
one authorization setting, for configuring at least one token (par. 0234-0245). 

Gupta or Barry, alone or in combination, does not expressly disclose an 
encryption option for encrypting the token. 

However, Khidekel discloses a token that can include a non-encrypted portion 
and an encrypted portion (Page 3, Par. 0034). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time of applicant's invention to modify the combined teachings of Gupta and Barry 
with teachings of Khidekel because it would allow to include a token that can include a 
non-encrypted portion and an encrypted portion as disclosed by Khidekel. This 
modification is not novel and would have been obvious because one of ordinary skill in 
the art would have been motivated by the suggestion of Khidekel to provide for more 
security. 
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Conclusion 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Arezoo Sherkat whose telephone number is (571) 272- 
3796. The examiner can normally be reached on 8:00-4:30 Monday-Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



A.S. 





Patent Examiner 
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